Extracted

• • Target
    b5969d44485233de50daf95c93a6f1f0d720fcdce44c6c0ecc7ccbea7d9cffca
  • Size 45KB
  • SHA256 b5969d44485233de50daf95c93a6f1f0d720fcdce44c6c0ecc7ccbea7d9cffca
  • MD5 767be524f888bc11bb77099d9bc3bb0d
  • SHA1 f4460c33e606bb0444dabc402c6255e449323c44
  • SHA512 9c1c6cd1db0152840e8aa3fba9734c553ca6e9b1946a82f1dc56cf7e832297cf41a718dc1718d37fd705bfb42129b15d3a35ebc7cfbb4c3eb54764f6f8049ca1
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN9O5QPCBjPSNjPI/zjbMgX3izNmQQvBuPej27XeBU:5uSy6pTpoo2MO5sMSK/3bDXScROa0wd2
  • TLSH
    T17B232B003BE9822BF2BE5F7498F26145467AF2633603E5491CC452DB4713FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2